CVE-2026-53507

Name of the Vulnerable Software and Affected Versions oasdiff-action versions prior to 0.0.51

Description oasdiff-action is a GitHub Action designed to detect breaking changes in OpenAPI specifications. The software resolves external $refs in the OpenAPI spec by default via the allow-external-refs variable. If an action processes a specification controlled by an attacker, such as in fork pull requests on public repositories, a $ref can be fetched or read on the runner without interaction. This leads to Server-Side Request Forgery (SSRF), where the server is coerced into making unauthorized requests, and the disclosure of structured files from the runner.

Recommendations Update oasdiff-action to version 0.0.51 or later.